EX200 Deploy, configure, and maintain systems Practice Question
A system administrator needs to restore the default SELinux security context on all files under /var/www/html after a misconfiguration. Which command should be used?
⚠ Common exam trap
Watch out — candidates often confuse `restorecon` with `chcon` or `setfiles`, thinking that manually setting the type with `chcon` is equivalent to restoring the default context, but `chcon` does not consult the policy and can set an incorrect type if the path's default context differs from the specified type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
restorecon -R /var/www/html
The `restorecon -R /var/www/html` command restores the default SELinux security contexts on all files under /var/www/html by reading the file contexts defined in the SELinux policy (typically from /etc/selinux/targeted/contexts/files/file_contexts). The `-R` flag ensures recursive operation, making it the correct tool to fix misconfigured contexts without manually specifying a type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
setfiles -R /var/www/html
Why it's wrong here
setfiles is a low-level SELinux utility that relabels files using a file_contexts specification file, which must be supplied as an explicit argument. Invoking `setfiles -R /var/www/html` without that specification will fail or run against an unintended policy database. It is intended for full filesystem relabeling during installation or policy updates, not for a quick targeted restore of a single directory like `restorecon`.
- ✓
restorecon -R /var/www/html
Why this is correct
restorecon is the correct command because it reads the active policy's `file_contexts` rules and resets each file's SELinux context to the default for its path. With `-R`, it descends recursively through `/var/www/html`, fixing any files whose contexts were altered by copying, misconfiguration, or manual `chcon`. It is the standard tool for restoring contexts on a specific path.
- ✗
fixfiles -R /var/www/html
Why it's wrong here
fixfiles is a high-level wrapper around `setfiles` and `restorecon` that is designed for broad filesystem relabeling tasks, such as `fixfiles restore` or `fixfiles onboot` for validation. The `-R` flag in `fixfiles` is not a path-recursive option; it actually expects an RPM package name and acts on files owned by that package. Passing a directory path after `-R` would not perform the intended recursive restore on that path, making this incorrect.
- ✗
chcon -R -t httpd_sys_content_t /var/www/html
Why it's wrong here
chcon manually changes the SELinux context of files to the specified type, `httpd_sys_content_t`, but it does so without consulting the policy's default `file_contexts` mappings. This means it only alters the type component and may leave the user, role, and range fields inconsistent with the true default context. The result is a forced context that is not guaranteed to match what `restorecon` would set, so it is not a restoration of defaults.
Go deeper
Related to this question
About these practice questions
One of 127 original EX200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.